Webhooks

import express from 'express';
import { AgentaOS, WebhookVerificationError } from '@agentaos/pay';

const agentaos = new AgentaOS(process.env.AGENTAOS_API_KEY!);

// IMPORTANT: express.raw(), not express.json(). Verification needs the
// exact bytes that were signed. Parsing JSON first breaks the signature.
app.post('/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = agentaos.webhooks.verify(
      req.body,                                       // raw body: string | Buffer
      req.headers['x-agentaos-signature'] as string,   // signature header
      process.env.AGENTAOS_WEBHOOK_SECRET!,            // whsec_... from the dashboard
    );
  } catch (err) {
    if (err instanceof WebhookVerificationError) {
      return res.status(400).send('Invalid signature');
    }
    throw err;
  }

  switch (event.type) {
    case 'checkout.session.completed':
      console.log('Paid:', event.data.amount, event.data.currency);
      break;
    case 'send.completed':
      console.log('Sent:', event.data.amount, event.data.token);
      break;
    case 'send.failed':
      console.log('Send failed:', event.data.transactionId);
      break;
  }

  res.sendStatus(200);
});